Pin identity-provisioner digest and readiness to directory preflight

Promote CI image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
with /readyz readiness and Recreate rollout. Live /healthz stays process
liveness; /readyz returned directory ready. Native onboarding remains for T05.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf

sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml

@@ -3,7 +3,7 @@ spec:
     spec:
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
           env:
             - name: PASSWORD_SETUP_TENANT_RETURNS
               value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/part-of: net-kingdom-sso-mfa
 spec:
   replicas: 1
+  strategy: {type: Recreate}
   selector:
     matchLabels: {app.kubernetes.io/name: identity-provisioner}
   template:
@@ -23,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -45,12 +46,11 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 250m, memory: 128Mi}
-          # /healthz is process liveness only. After the T05 image is pinned,
-          # switch readiness to /readyz (timeoutSeconds >= 5) so a rejected
-          # directory bind takes the pod out of Service endpoints.
           readinessProbe:
-            httpGet: {path: /healthz, port: http}
-            periodSeconds: 10
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 3
           livenessProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 20